AQE v2 won't initialize: sends invalid HTTP packet to update server

Hey,

Earlier in the year Engage Liverpool CIC bought five air quality eggs (v2) which they didn't have a lot of luck with (for various reasons). I don't know a lot about their history but I've recently volunteered to round them up and figure out what's going on with them.

These two eggs appear to have an identical problem when booting:

• egg00802260b51b0151
• egg0080225cfd080143

I've done the recommended restore defaults, ssid Fawkesley, pwd <password> then exit and I get this:

+------------------------------------+
 |   Welcome to Air Quality Egg 2.0   |
 |       NO2 / CO Sensor Suite        |
 |       Firmware Version 2.0.8       |
 +------------------------------------+
 Compiled on: May  2 2016 12:25:37
 Egg Serial Number: egg0080225cfd080143

Info: Tiny Watchdog Initialization...OK.
Info: Slot Select Pins Initialization...OK.
Info: SPI Flash Initialization...OK.
Info: SD Card Initialization...Fail.
Info: Current firmware signature: 4294967295 65535
Info: SHT25 Initialization...OK.
Info: NO2 Sensor AFE Initialization...OK.
Info: NO2 Sensor ADC Initialization...OK.
Info: CO Sensor AFE Initialization...OK.
Info: CO Sensor ADC Initialization...OK.
Info: RTC Initialization...Fail.
Info: CC3000 Initialization...OK.
Enter 'aqe' for CONFIG mode.
OPERATIONAL mode automatically begins after 12 secs of no input.
11...10...9...8...7...6...5...4...3...2...1...0...
-~=* In OPERATIONAL Mode *=~-
Info: Beginning Network Scan...
Info: Network Scan found 0 networks
Info: Connecting to Access Point with SSID "Fawkesley"...OK.
Info: Request DHCP...OK.
Info: IP Addr: 192.168.0.198
Info: Netmask: 255.255.255.0
Info: Gateway: 192.168.0.1
Info: DHCPsrv: 192.168.0.1
Info: DNSserv: 192.168.0.1
Info: Mirrored configuration already matches current configuration.
Info: Resolved "update.wickeddevice.com" to IP address 45.55.159.249
Info: Attempt #1 downloading "aqev2_no2_co.chk"

Every time both eggs time out and reboot at this stage.

Packet capture with Wireshark

To try and see what's going on, I set up Internet sharing on my mac called test_network with no security. I did restore defaults, ssid test_network, security open and exit. I captured the wireless interface with Wireshark.

It connects (quicker than with WPA2!) and hits the same thing:

AQE>: -~=* In OPERATIONAL Mode *=~-
Info: Beginning Network Scan...
Info: Network Scan found 2 networks
Info: Found Access Point "test_network", RSSI = 83
Info: Connecting to Access Point with SSID "test_network"...OK.
Info: Request DHCP...OK.
Info: IP Addr: 192.168.2.3
Info: Netmask: 255.255.255.0
Info: Gateway: 192.168.2.1
Info: DHCPsrv: 192.168.2.1
Info: DNSserv: 192.168.2.1
Info: Erasing mirrored config...OK.
Info: Writing mirrored config...OK.
Info: Resolved "update.wickeddevice.com" to IP address 45.55.159.249
Info: Attempt #1 downloading "aqev2_no2_co.chk"

However I managed to grab this packet capture which looks wrong. I followed the TCP stream and all it sent to the server was the following:

GET /

Since there's no data to receive, the connection just times out I guess, and we're back in the reboot loop.

Expected behaviour

When I capture the same update request from a working egg, I see the following (> and < added to show direction):

GET /aqev2_no2_co.chk HTTP/1.1
Host: update.wickeddevice.com


HTTP/1.1 200 OK
Date: Wed, 21 Dec 2016 13:47:48 GMT
Server: Apache/2.4.7 (Ubuntu)
Last-Modified: Mon, 02 May 2016 16:27:51 GMT
ETag: "c-531de7951ffa3"
Accept-Ranges: bytes
Content-Length: 12

354602 15615

Other things I've tried

I've tried doing restore defaults, ssid ..., pwd ... then force update but I get the same thing.

Any help gratefully received!